ISMS Worked Walkthrough Template (ISO/IEC 27001 in 6 Months)

ISMS Worked Walkthrough: [Organization name]

Narrative worked example that follows one fictional small company, Quillmere Analytics Ltd, from the decision to build an information security management system (ISMS) to an ISO/IEC 27001:2022 + Amd 1:2024 certificate in about six months. At each step it shows a filled extract of the key record (scope statement, risk entry, Statement of Applicability rows, objective, internal audit finding, management review decision, Stage 2 finding and closure) and points to the library template that holds the full format. Use it to see how the documents connect, then write your own project diary in section 17. Every company detail, date, figure and ID is fictional and marked Example. Replace every [bracketed] value and every row marked Example when you reuse a format.

Document control

Approvals

Revision history

Contents

1. About Quillmere Analytics Ltd
2. Timeline at a glance
3. Month 1: decide and start
4. Month 1: context and scope
5. Month 2: risk assessment and treatment
6. Month 2 to 3: Statement of Applicability
7. Month 2 to 3: objectives and control implementation
8. Month 3: internal audit
9. Month 4: management review
10. Month 4: Stage 1 audit
11. Month 5: Stage 2 audit
12. Month 6: findings closure and certification decision
13. After the certificate
14. Lessons learned
15. Size tiers: the same story at other sizes
16. Records and evidence
17. Your own project diary
18. References

1. About Quillmere Analytics Ltd

Quillmere Analytics Ltd (Example) sells a business-to-business SaaS analytics platform to retail customers. It has 46 staff: 38 employees and 8 contractors. Everyone works from one office or remotely. Production runs on one public cloud provider in two regions, a primary region and a disaster recovery (DR) region. The platform holds customer datasets that include personal data, which Quillmere processes as a processor under data processing agreements; GDPR is one example of the data protection law its customers rely on.

Two enterprise customers made an accredited ISO/IEC 27001 certificate a condition of their contract renewals, due in the summer of 2027. The CEO decided on 2027-01-04 to build an ISMS and seek certification within six months. The Head of Engineering Operations became ISMS manager for half of their time (0.5 FTE). No consultant ran the project; an external auditor was contracted for the internal audit only.

Quillmere was not starting from nothing. It already had single sign-on for most tools, encrypted laptops, cloud backups, a leaver process run by HR and an engineering metrics dashboard reviewed monthly. The ISMS project gave these practices owners, documents and records, and filled the gaps around them.

2. Timeline at a glance

From decision to certification decision took 162 days, a little over five months, inside the six-month target.

3. Month 1: decide and start

In the first week the CEO signed a two-page business case (isms/isms-business-case, DOC-ISMS-029) built on the two contract renewals and a list of security questionnaires that took engineers about a day each. The project charter (isms/isms-project-charter, DOC-ISMS-009) named the CEO as sponsor, the Head of Engineering Operations as ISMS manager and project lead, and the leadership team as the steering committee meeting every two weeks.

A gap assessment against clauses 4 to 10 and Annex A (compliance/iso-27001-gap-assessment, DOC-ISMS-098) took the ISMS manager four days. The main gaps were the ones most young companies share: no documented scope, no risk methodology or register, no SoA, no internal audit, no management review, an informal process for contractor leavers and a supplier list that covered only paid infrastructure services.

Quillmere compared three accredited certification bodies with isms/certification-body-selection (DOC-ISMS-090), checked that each held ISO/IEC 27001 accreditation from a signatory of the Global ACI MRA (formerly IAF MLA), and selected the one shown as Bidder B in that template's worked example. The CB set audit time from ISO/IEC 27006-1: 1.5 days for Stage 1 and 3.5 days for Stage 2, 5.0 audit days for the initial audit (Example). The roadmap (isms/isms-implementation-roadmap, DOC-ISMS-030) was then fixed around the CB's available dates.

4. Month 1: context and scope

The context and interested parties record (isms/isms-context-interested-parties, DOC-ISMS-003) listed issues such as customer demands for certification, dependence on one cloud provider, a tight labour market for security skills and data protection obligations as processor. Following Amd 1:2024 to clause 4.1, the team considered whether climate change was a relevant issue; they judged it relevant only through the cloud provider's regional resilience, already covered by the DR region.

Extract 1: scope statement and interfaces (Example). Full format: compliance/ms-scope (DOC-ISMS-002), sections 4 and 5.

Scope statement (Example): "The information security management system covering the development, operation and support of the Quillmere Analytics SaaS platform, including the office, remote staff and the production and DR environments hosted by a public cloud provider."

The scope was approved at the steering committee on 2027-01-29 as DOC-ISMS-002 v1.0. Every person working on the platform, all 46, fell inside it.

5. Month 2: risk assessment and treatment

The ISMS manager adapted the methodology (compliance/risk-methodology, DOC-ISMS-010): likelihood 1 to 5 times impact 1 to 5, score 1 to 25, bands Low 1-4, Medium 5-9, High 10-16, Critical 17 to 25 (in practice 20 and 25). Risk criteria and appetite went into isms/isms-risk-appetite-criteria (DOC-ISMS-015), and workshops with each team produced the register (compliance/risk-register, DOC-ISMS-016) using the threat and vulnerability catalogue (isms/isms-threat-vulnerability-catalogue, DOC-ISMS-018).

Extract 2: risk register entry (Example). Full format: compliance/risk-register (DOC-ISMS-016), section 3; acceptance in isms/isms-risk-acceptance-record (DOC-ISMS-019), worked example ACC-001.

Because the category appetite was Averse, the appetite rules escalated acceptance one level, and the CEO accepted the residual risk on 2027-03-31 after the ISMS manager's review. The scores add up on the 5 x 5 scale: 3 x 4 = 12 (High) before, 2 x 4 = 8 (Medium) with the compensating controls, and a target of 1 x 4 = 4 (Low) once the service is replaced.

R-018 was the one acceptance that was fully documented at this stage. The treatment plan (compliance/risk-treatment-plan, DOC-ISMS-013) was drafted on 2027-02-26, but the team did not obtain risk owners' approval of the plan or their acceptance of the other residual risks. That gap returns in section 11.

6. Month 2 to 3: Statement of Applicability

The SoA compared the controls chosen in risk treatment with all 93 Annex A controls (37 organizational, 8 people, 14 physical, 34 technological). Each row gives a basis code: R (risk), L (law), C (contract), B (business need).

Extract 3: Statement of Applicability rows (Example). Full format: compliance/statement-of-applicability (DOC-ISMS-011), section 4.

The SoA was approved as DOC-ISMS-011 v1.1 on 2027-03-10. The evidence column was the start of the control evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033), which later saved hours at Stage 2.

7. Month 2 to 3: objectives and control implementation

Six objectives went into the objectives register (compliance/objectives-register, DOC-ISMS-024) in February. Most work in months 2 and 3 went into implementing treatment actions: connecting more tools to single sign-on, writing the access control policy (isms/access-control-policy, DOC-ISMS-041), the backup policy, the supplier register and the security event reporting procedure, and running awareness training for all staff.

Extract 4: objective and plan (Example). Full format: compliance/objectives-register (DOC-ISMS-024), sections 1 and 2.

The baseline was added after the internal audit (section 8): at first, four of the six objectives had targets but no baseline.

8. Month 3: internal audit

An external contract auditor carried out the first internal audit (IA-2027-01) from 2027-03-15 to 2027-03-17 against clauses 4 to 10 and 30 Annex A controls, using isms/isms-internal-audit-checklist (DOC-ISMS-083). The report, issued on 2027-03-29, recorded 0 major nonconformities, 2 minor nonconformities, 1 observation and 1 opportunity for improvement.

Extract 5: internal audit finding (Example). Full format: isms/isms-internal-audit-report (DOC-ISMS-084), section 7; tracked in isms/audit-findings-register (DOC-ISMS-086).

The other minor nonconformity (AF-2027-001) found that monthly metric results were collected but not analysed for three months; the opportunity for improvement (AF-2027-004) produced the objective baselines shown in section 7.

9. Month 4: management review

The first management review (MR-2027-01) took place on 2027-04-06, a week after the internal audit report, with the CEO, the leadership team and the ISMS manager. Inputs included the audit results, the risk register summary, objective status, supplier issues and the first security events.

Extract 6: management review decisions (Example). Full format: compliance/management-review (DOC-ISMS-085), sections 4 and 5.

Two weaknesses in this review shaped later events. The agenda did not record a review of the climate change decision from clause 4.1, which the Stage 1 auditor noted (section 10). And MR-D-03 scheduled the single sign-on work for Q3, after Stage 2, so tools with local accounts stayed outside the leaver process during the audit (section 11).

10. Month 4: Stage 1 audit

Stage 1 ran on 2027-04-12 and 2027-04-13 (1.5 audit days), largely remotely. The ISMS manager had assembled the documents with isms/stage-1-readiness-pack (DOC-ISMS-091): scope, policy, methodology, risk register and treatment plan, SoA, objectives, competence records, the internal audit report and the management review minutes.

The auditor confirmed the scope, the 46 persons in scope and the Stage 2 plan: 3.5 audit days from 2027-05-10 to 2027-05-12 (for example a lead auditor for three days and a second auditor for half a day), on site at the office with remote demonstrations of the cloud environment. The Stage 1 report, received on 2027-04-16, raised three areas of concern: the climate change decision from clause 4.1 was neither recorded in the context record nor reviewed at the management review (AOC-01), the management review had not covered feedback from interested parties (AOC-02), and two persons in scope had not completed awareness training (AOC-03). Quillmere copied them into the tracker in section 9 of the readiness pack, logged the climate change item as AF-2027-005 in the audit findings register, updated the context record and the management review agenda, and closed all three by 2027-05-07, before Stage 2.

The auditor did not raise the unsigned treatment plan at Stage 1. Stage 1 is a readiness review, not a complete audit; silence at Stage 1 is not clearance.

11. Month 5: Stage 2 audit

The CB audit team spent 3.5 audit days over three calendar days, 2027-05-10 to 2027-05-12, interviewing the CEO, the ISMS manager, engineers, HR and support staff, and sampling records across the SoA, guided by isms/stage-2-audit-evidence-index (DOC-ISMS-092). At the closing meeting the lead auditor reported 1 major nonconformity, 3 minor nonconformities and 4 opportunities for improvement, and recommended certification subject to verified closure of the major.

Extract 7: Stage 2 findings and closure (Example). Full format: isms/certification-findings-action-plan (DOC-ISMS-093), sections 4 and 6.

The second finding is the same story as R-018, AF-2027-002 and MR-D-03: the internal audit fixed the contractor route, but tools outside single sign-on were still invisible to the leaver process. Following one risk through every record would have found it earlier.

12. Month 6: findings closure and certification decision

The CB's Example deadlines were 30 days for the plan (2027-06-11) and 90 days for evidence of the major (2027-08-10). Quillmere submitted the plan on 2027-05-26 and the major's evidence on 2027-06-02, both well inside the limits. The CB verified the major closed on 2027-06-09, and its independent decision maker, who had not been on the audit team, granted certification on 2027-06-15. The certificate expires on 2030-06-14 and references the SoA version the CB audited.

The first certification-year CB fees in the Example came to USD 8,100 for 5.0 audit days and the annual fee (see isms/certification-cycle-plan, section 11; use local currency). Quillmere then published its certificate under the CB's mark rules (isms/certification-mark-usage, DOC-ISMS-097) and sent it to both enterprise customers ahead of renewal.

13. After the certificate

The certification cycle plan (isms/certification-cycle-plan, DOC-ISMS-094) set the next steps (Example):

Eight weeks before surveillance 1, the ISMS manager runs isms/surveillance-readiness-health-check (DOC-ISMS-096).

14. Lessons learned

15. Size tiers: the same story at other sizes

16. Records and evidence

Map each record to its clause or control in isms/control-evidence-matrix (DOC-ISMS-033) and list it in isms/isms-documented-information-register (DOC-ISMS-028).

17. Your own project diary

18. References

Related templates: isms/certification-audit-explained (LRN-ISMS-07), isms/isms-business-case (DOC-ISMS-029), isms/isms-project-charter (DOC-ISMS-009), compliance/iso-27001-gap-assessment (DOC-ISMS-098), isms/certification-body-selection (DOC-ISMS-090), isms/isms-implementation-roadmap (DOC-ISMS-030), isms/isms-context-interested-parties (DOC-ISMS-003), compliance/ms-scope (DOC-ISMS-002), compliance/risk-methodology (DOC-ISMS-010), isms/isms-risk-appetite-criteria (DOC-ISMS-015), compliance/risk-register (DOC-ISMS-016), compliance/risk-treatment-plan (DOC-ISMS-013), isms/isms-risk-acceptance-record (DOC-ISMS-019), compliance/statement-of-applicability (DOC-ISMS-011), compliance/objectives-register (DOC-ISMS-024), isms/isms-internal-audit-report (DOC-ISMS-084), isms/audit-findings-register (DOC-ISMS-086), compliance/management-review (DOC-ISMS-085), isms/stage-1-readiness-pack (DOC-ISMS-091), isms/stage-2-audit-evidence-index (DOC-ISMS-092), isms/certification-findings-action-plan (DOC-ISMS-093), isms/certification-cycle-plan (DOC-ISMS-094), isms/control-evidence-matrix (DOC-ISMS-033).

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 and with the certification process that ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024 set for certification bodies. The narrative, extracts and lessons are original; Quillmere Analytics Ltd and every figure, date and ID are fictional. No ISO or IEC text is reproduced; control labels are short descriptions, not official titles. Read the official standards (purchase or licensed access from ISO, IEC or your national standards body) before relying on any statement here, and check the current edition of each standard before use. Certification decisions are made only by the accredited certification body. This is a learning example, not certification or legal advice. Template licence: MIT.